Analysis
- max time kernel
165s - max time network
164s - platform
windows10-2004_x64 - resource
win10v2004-en-20220112 - submitted
22/02/2022, 08:03
General
- Target 2cebb75fc2d6ee8cc6edf5a68940f0a6cb3ee78f3eb3462e9cd0eb8ef6f2900e.exe
- Size 202KB
- Sample220222-jx16ysedd2
- SHA256 2cebb75fc2d6ee8cc6edf5a68940f0a6cb3ee78f3eb3462e9cd0eb8ef6f2900e
Malware Config
Extracted
-
blacknet
-
v3.5 Public
-
new
-
http://142.202.136.146/NET
-
BN[YVgjyUVe-8846047]
-
antivm
false
-
elevate_uac
false
-
install_name
WindowsUpdate.exe
-
splitter
|BN|
-
start_name
14247ae8e9bdf8a07859c46cc6c701e5
-
startup
false
-
usb_spread
false
Signatures
- BlackNET
BlackNET is an open source remote access tool written in VB.NET.
- BlackNET Payload 1 IoCs
- Contains code to disable Windows Defender 1 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Executes dropped EXE 4 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 31 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2cebb75fc2d6ee8cc6edf5a68940f0a6cb3ee78f3eb3462e9cd0eb8ef6f2900e.exe"C:\Users\Admin\AppData\Local\Temp\2cebb75fc2d6ee8cc6edf5a68940f0a6cb3ee78f3eb3462e9cd0eb8ef6f2900e.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exeC:\Users\Admin\AppData\Local\Temp\InstallUtil.exe2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exeC:\Users\Admin\AppData\Local\Temp\InstallUtil.exe2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exeC:\Users\Admin\AppData\Local\Temp\InstallUtil.exe2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exeC:\Users\Admin\AppData\Local\Temp\InstallUtil.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\system32\MusNotifyIcon.exe%systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 131⤵
- Checks processor information in registry
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3412-134-0x0000000001270000-0x00000000012D6000-memory.dmp
memory/3412-135-0x0000000006650000-0x0000000006BF4000-memory.dmp
memory/3412-130-0x000000007536E000-0x000000007536F000-memory.dmp
memory/3412-133-0x0000000001380000-0x0000000001412000-memory.dmp
memory/3412-132-0x0000000005460000-0x0000000005461000-memory.dmp
memory/3412-131-0x0000000000B30000-0x0000000000B68000-memory.dmp
memory/4000-139-0x0000000000400000-0x000000000041A000-memory.dmp
memory/4000-142-0x000000007536E000-0x000000007536F000-memory.dmp
memory/4000-143-0x0000000005340000-0x00000000053DC000-memory.dmp
memory/4000-144-0x00000000056E0000-0x00000000056E1000-memory.dmp
memory/4000-145-0x0000000005400000-0x000000000540A000-memory.dmp
memory/4000-146-0x00000000056F0000-0x0000000005746000-memory.dmp